# Filebeat multiline log into ES/Kib

**URL:** https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478
**Category:** Beats
**Tags:** filebeat
**Created:** [August 4, 2021, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478 "2021-08-04T22:31:29Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![marc\_b](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc_b/32/92550_2.png) [@marc\_b](https://discuss.elastic.co/u/marc_b)
#### Post date: [August 4, 2021, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478/1 "2021-08-04T22:31:29Z")

</div>

Hi,

Searching for assistance here if possible.

I have log files that are created by using the 'SET' command piped into a file. (exporting environment variables) in the example shape below -

ALLUSERSPROFILE=C:\ProgramData  
ANDROID\_SDK\_HOME=C:\Android  
APPDATA=C:\Users\JamesBond\AppData\Roaming  
ChocolateyInstall=C:\ProgramData\chocolatey

And have an ingest pipeline noted below -

```auto
{
    "kv": {
      "field": "_source.message",
      "field_split": "\" \"",
      "value_split": "=",
      "ignore_missing": true,
      "strip_brackets": true,
      "description": "Equals delimited data"
    }
  }

```

I'm attempting to record the fields in a timeline - for example, what date/time 'APPDATA' was for a certain user (the field value).... (I hope this description makes sense!)

Currently I'm only seeing the last line in the log as 'message' data, no other fields are being parsed and I'm stumped as to where to look next.

Any tips would be gratefully appreciated!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2021, 12:32am UTC](https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478/2 "2021-09-02T00:32:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.